The hacker group NoName057(16) has been active since the outbreak of the Russian war against Ukraine, carrying out DDoS attacks against critical infrastructure during (political) high-level events. The hacktivist group conducted 14 attacks in Germany, some lasting several days and affecting about 230 organizations, including arms factories, energy suppliers, and government institutions.
During last year's European elections, attempts were also made to shut down the internet all across Europe. In Sweden, authorities and banking websites were targeted, and in Switzerland during official speeches by Ukrainian President Zelensky at the peace summit for Ukraine in June 2024. Most recently, the NATO summit in The Hague, Netherlands, at the end of June was the target of the internet attackers.
To carry out their attacks, the group recruited supporters via a messaging service. It is estimated that the hackers could use the PCs of approximately 4,000 users to participate in the DDoS attacks. The group also built its own botnet with hundreds of servers worldwide.
During a joint day of action (on July 15), the EU justice agency Eurojust coordinated all last-minute judicial requests necessary for the operation. Authorities were able to disrupt more than 100 servers used by the hackers. Raids were conducted at 24 locations in Germany, Spain, Italy, the Czech Republic, Poland, and France on request of Europol and Interpol.
International arrest warrants have been issued for eight suspects. Germany issued six warrants for the main suspects who live in the Russian Federation. Two suspects are accused of being the key instigators responsible for the activities of NoName057(16).